GHSA-m87h-jxr6-f82w CVE-2023-48648
Concrete CMS allows unauthorized access because directories can be created with insecure permissions
- Severity
- 9.8 / 10
- Critical · CVSS 3.1
- Exploit chance (EPSS)
- 1.23%
- Chance of exploitation in the next 30 days. Higher than 69.02% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-276 Incorrect Default Permissions
- Fix
8.5.13- Upgrade concrete5/concrete5 to this version or later
Description
Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insecure permissions. File creation functions (such as the Mkdir() function) gives universal access (0777) to created folders by default. Excessive permissions can be granted when creating a directory with permissions greater than 0755 or when the permissions argument is not specified.
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| concrete5/concrete5 | < 8.5.13 |
8.5.13 |
| concrete5/concrete5 | >= 9.0.0, < 9.2.2 |
9.2.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
concrete5/concrete5 Packagist → 8.5.13
- composer
composer require concrete5/concrete5:^8.5.13
Severity breakdown
CVSS 3.1 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-276: Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
How to prevent it
- Architecture and Design, Operation: The architecture needs to access and modification attributes for files to only those users who actually require those actions.
- Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
References
Advisories
Packages
Other links
- github.com/concretecms/concretecms/pull/11677
- github.com/concretecms/concretecms/commit/707b974826b761dda5c0baaf345c8582157d9307
- github.com/concretecms/concretecms/commit/eb882681a0ed19798a8f689d257af8dfe2f3a279
- documentation.concretecms.org/developers/introduction/version-history/8513-release-notes
- documentation.concretecms.org/developers/introduction/version-history/922-release-notes
- concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-c…
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-g82f-9pw7-773w Concrete CMS: PHP Object Injection via unserialize() calls | High | Also affects concrete5/concrete5 |
| GHSA-52pr-7vmf-2w7x Concrete CMS is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components | High | Also affects concrete5/concrete5 |
| GHSA-q9fm-mpg8-8jqm Concrete CMS is vulnerable to Stored XSS via page name in the Atomik theme | Medium | Also affects concrete5/concrete5 |
| GHSA-jqvq-gv67-3567 Concrete CMS is vulnerable to IDOR + wrong-authorization-level in the Express association Reorder dialog | Medium | Also affects concrete5/concrete5 |
| GHSA-xjg6-5v39-v7fc Concrete CMS is vulnerable to CSRF via Backend\File::approveVersion | Medium | Also affects concrete5/concrete5 |
| GHSA-44q4-354f-c826 Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion() | Medium | Also affects concrete5/concrete5 |
| GHSA-6qjh-p324-694f Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple() | High | Also affects concrete5/concrete5 |
| GHSA-6fxm-r8p3-mx5c Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan() | High | Also affects concrete5/concrete5 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor